Privacy Policy

1. Who we are

This Privacy Policy applies to Lunch Box (“Lunch Box,” “we,” “us,” or “our”) and this website. It does not replace the separate privacy terms of third-party services you choose to use, including Square payment services once enabled or AppiSpot’s booking service.

2. Information we collect

Information you provide

• Pickup-order details, including your name, phone number, email address, order items, selected options, and notes.
• Event, booking, contact, and accessibility requests you send to us.
• Communications concerning refunds, order problems, privacy requests, or customer support.
• Administrative login and security information for authorized staff.

Information collected automatically

Our website and service providers may process basic technical information such as IP address, browser type, device type, referring page, timestamps, request logs, and error or security events. We use necessary browser storage to remember cookie choices and, in the admin portal, a session token for authorized staff.

Payment information

Online card payment is not currently enabled. When it is enabled, card details will be collected securely by Square and processed by Square rather than stored in our website or Convex database. We may receive transaction identifiers, payment status, amount, and limited confirmation information needed to match payment to an order. We do not intentionally collect or store full payment-card numbers or card security codes.

3. How we use information

• Create, confirm, prepare, update, and fulfill pickup orders.
• Process payment confirmations and resolve payment or refund questions.
• Operate the live order-status board while limiting public display to first names and order numbers.
• Respond to questions, event inquiries, accessibility needs, and customer-service requests.
• Maintain menu and event content and protect the admin portal.
• Prevent fraud, duplicate charges, abuse, and security incidents.
• Comply with legal, tax, accounting, licensing, and recordkeeping obligations.
• Improve site reliability, usability, and performance.

4. How we share information

We disclose information only as reasonably needed for the purposes described above, including to:

• Convex, which provides database, storage, and backend services for menus, events, orders, and administrative functions.
• Square, which will provide payment processing once the Lunch Box Square account is connected.
• AppiSpot, when you follow a link to inquire about or book the space.
• Website hosting, security, email, technical-support, professional, accounting, or legal providers working for us.
• Government authorities or other parties when required by law, necessary to protect rights and safety, or connected with a business transfer.

We do not currently sell personal data or use it for targeted advertising.

5. Cookies and browser storage

We do not currently use analytics or advertising cookies. We use necessary browser storage to remember your cookie preference and support essential site or staff-session functionality. See our Cookie Policy and use “Cookie settings” in the footer to review or change your choice.

6. Data retention

We keep information only as long as reasonably necessary for order fulfillment, customer support, fraud prevention, legal compliance, accounting, dispute resolution, and enforcement of agreements. Retention periods vary by record type. Public order-status entries are not intended to remain displayed indefinitely. We may retain transaction and order records longer where required for business or legal purposes.

7. Your privacy choices and rights

Depending on where you live and whether a law applies to our processing, you may request access to, correction of, deletion of, or a portable copy of certain personal data. You may also request confirmation of whether we process your data and opt out of sale, targeted advertising, or qualifying profiling. We do not currently sell personal data or conduct targeted advertising.

Connecticut residents may have rights under the Connecticut Data Privacy Act. We may need to verify your identity before fulfilling a request. If we deny an applicable request, you may ask us to appeal the decision. We will not discriminate against you for exercising applicable privacy rights.

Send requests to contact@lunchbox.example with “Privacy Request” in the subject line. An authorized agent should identify the person represented and provide evidence of authority.

8. Global Privacy Control

Because we do not currently sell personal data or use it for targeted advertising, there is no sale or targeted-advertising activity to opt out of. If that changes, we intend to recognize legally required opt-out preference signals, including Global Privacy Control, where applicable.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These include server-side payment creation, restricted administrative functions, rate-limited admin login, and avoiding storage of full card details. No transmission or storage system can be guaranteed completely secure.

10. Children and alcohol-related services

This website is not directed to children. Online alcoholic-beverage ordering is limited to people age 21 or older, and valid identification may be required at pickup. We do not knowingly collect personal data from children through online ordering.

11. Third-party links and services

Links to Square, AppiSpot, maps, social platforms, or other websites are governed by those services’ own privacy practices. We are not responsible for their content, security, or privacy practices.

12. Policy changes

We may update this policy as our services or legal obligations change. We will post the revised version here and update the effective date. Material changes may receive additional notice where appropriate.